PT-2006-1871 · Geeklog · Geeklog

James Bercegay · Published 2006-02-21 · Updated 2018-10-18 · CVE-2006-0824

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Geeklog versions 1.3.11 through 1.3.11sr3 Geeklog versions 1.4.0 through 1.4.0sr0

Description The issue allows remote attackers to include arbitrary local files and execute arbitrary code. This can be achieved via absolute paths in unspecified parameters and the language cookie. For example, code execution can be demonstrated using error.log.

Recommendations For Geeklog versions 1.3.11 through 1.3.11sr3, update to version 1.3.11sr4 to resolve the issue. For Geeklog versions 1.4.0 through 1.4.0sr0, update to version 1.4.0sr1 to resolve the issue. As a temporary workaround, consider restricting access to the language cookie and unspecified parameters in lib-common.php to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-0824

Affected Products

Geeklog

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-0824 · Security Note
• http://secunia.com/advisories/18920 · Vendor Advisory
• http://geeklog.net/article.php/geeklog-1.4.0sr1 · Patch
• http://securityfocus.com/archive/1/425506/100/0/threaded · Note
• http://securityfocus.com/bid/16755 · Note
• http://osvdb.org/23349 · Note
• http://vupen.com/english/advisories/2006/0661 · Note
• http://gulftech.org/?node=research&article_id=00102-02192006 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0824 · Note